Flaws in a widely used wireless technology could allow hackers to gain remote control of phones and instruct them to send text messages or make calls, according to an expert on mobile phone security.
They could use the vulnerability in the GSM technology - which is used by most telecom operators globally and by billions of people - to make calls or send texts to expensive, premium phone and messaging services in scams, said Karsten Nohl, head of Berlin-based Security Research Labs.
Nohl is a well-regarded expert on mobile security who last year identified a bug in GSM technology that makes calls vulnerable to tapping. He says he is calling attention to these flaws to pressure the industry into beefing up the security of their products.
Mobile security is a hot issue because hackers are paying unprecedented attention to the devices as smartphone sales have outpaced sales of PCs.
Only a few flaws have been found in GSM technology - which stands for Global System for Mobile Communications - over its 20-year history. Industry lobby group GSMA said on December 27 it did not expect the new findings to affect its views on the security of the technology.
"The GSMA and its mobile network operator members are confident in the security of existing 2G GSM networks and real attacks on real networks against real customers are most unlikely," it said in a statement, adding that newer technologies are safer and not impacted by the new research.
GSMA's statement "on anticipated GSM security announcements" did not make clear whether the industry group had actually seen Nohl's latest research.
Security experts have previously identified a small number of viruses designed to infect smartphones, allowing hackers to take control of the devices and force them to make calls or send text messages. But Nohl said he has discovered a way to leverage previously disclosed vulnerabilities in GSM technology that could potentially threaten hundreds of thousands of phones.
"We can do it to hundreds of thousands of phones in a short time frame," Nohl told Reuters ahead of a presentation on the topic at a hacking convention in Berlin on Tuesday.
Smartphone malware is popping up at an unprecedented rate as people put more and more valuable information on the devices, using them to hold corporate secrets, conduct banking and function as digital wallets.
GSM became the dominant mobile technology globally in the late 1990s and even though new, faster mobile networks have been rolled out across the world, operators have stuck to their GSM networks to support older phones and to offer service when new networks fail.
The Berlin convention takes place just days after US security think tank Strategic Forecasting Inc (Stratfor) said its website had been hacked and that some names of corporate subscribers had been made public. Activist hacker group Anonymous claimed responsibility.